Process monitoring method and terminal

Abstract

The invention discloses a process monitoring method and a terminal, and the method comprises the steps: obtaining a process page table address of a to-be-monitored process, storing a public page table management object in the address, obtaining a first page table management object address corresponding to the to-be-monitored process, then building a preset memory block with the same data as the first page table management object address, and storing the preset memory block in the to-be-monitored process; and replacing the page table item of the original first page table management object address in the page table management object with the second page table management object address so as to flexibly monitor the single process. In this way, the process can be monitored only by replacing the page table entry of the process to be monitored, and compared with a method for monitoring all processes through a chip technology in the prior art, the method does not need support of the chip technology, and flexible monitoring of a single process can be conducted.

Description

Technical Field

[0001] The present invention relates to the technical field of process monitoring, and in particular to a process monitoring method and a terminal. Background Art

[0002] Currently, the virtual machine mode allows monitoring of all major system components, including monitoring of APIs. Since inline hooks are required to monitor API calls in a non-virtual environment, Microsoft prohibits developers from arbitrarily modifying system functions with inline hooks in system design, and only allows virtual machines to take over APIs and monitor them.

[0003] Whether it is the VT-x virtualization function of Intel chips or the SVM virtualization function of AMD chips, there can only be one pit when using virtual technology. Other interveners must either be kicked out of the original pit or nested, and there is a priority level capture. Therefore, there will be instability and uncertainty in the monitoring process, resulting in fault codes in some software; and there are version differences between systems, and it cannot be guaranteed that all versions of the system are stable and allowed in virtualization. At the same time, version adaptation is required in the use of virtual technology, which increases the workload. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a process monitoring method and a terminal, which can flexibly monitor any process and do not require the support of chip technology.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0006] A process monitoring method comprises the steps of:

[0007] Obtaining a process page table address of a process to be monitored, determining a corresponding page table management object of a system space according to the process page table address, and obtaining a first page table management object address corresponding to the process to be monitored from the page table management object;

[0008] Copy the content of the first page table management object address obtained into a preset memory block to obtain a second page table management object address;

[0009] The page table entry corresponding to the first page table management object address in the page table management object is modified to the second page table management object address, and the second page table management object address is monitored.

[0010] In order to solve the above technical problems, another technical solution adopted by the present invention is:

[0011] A process monitoring terminal comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0012] Obtaining a process page table address of a process to be monitored, determining a corresponding page table management object of a system space according to the process page table address, and obtaining a first page table management object address corresponding to the process to be monitored from the page table management object;

[0013] Copy the content of the first page table management object address obtained into a preset memory block to obtain a second page table management object address;

[0014] The page table entry corresponding to the first page table management object address in the page table management object is modified to the second page table management object address, and the second page table management object address is monitored.

[0015] The beneficial effect of the present invention is that: the process page table address of the process to be monitored is obtained, and the address stores a common page table management object, thereby obtaining the first page table management object address corresponding to the process to be monitored, and then a preset memory block with the same data as the first page table management object address is newly created, and the second page table management object address replaces the page table entry of the original first page table management object address in the page table management object, so as to flexibly monitor a single process. In this way, the process can be monitored by replacing the page table entry of the process to be monitored. Compared with the method of using chip technology to monitor all processes in the prior art, the present invention does not require the support of chip technology and can also perform flexible monitoring of a single process. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of a process monitoring method according to an embodiment of the present invention;

[0017] Figure 2 A schematic diagram of a process monitoring terminal according to an embodiment of the present invention;

[0018] Figure 3 A storage structure diagram of a process space of a process monitoring method according to an embodiment of the present invention;

[0019] Description of labels:

[0020] 1. A process monitoring terminal; 2. A memory; 3. A processor. DETAILED DESCRIPTION

[0021] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is an explanation in combination with the implementation modes and the accompanying drawings.

[0022] Please refer to Figure 1, an embodiment of the present invention provides a process monitoring method, comprising the steps of:

[0023] Obtaining a process page table address of a process to be monitored, determining a corresponding page table management object of a system space according to the process page table address, and obtaining a first page table management object address corresponding to the process to be monitored from the page table management object;

[0024] Copy the content of the first page table management object address obtained into a preset memory block to obtain a second page table management object address;

[0025] The page table entry corresponding to the first page table management object address in the page table management object is modified to the second page table management object address, and the second page table management object address is monitored.

[0026] From the above description, it can be seen that the beneficial effect of the present invention is: obtaining the process page table address of the process to be monitored, which stores a common page table management object, thereby obtaining the first page table management object address corresponding to the process to be monitored, and then creating a preset memory block with the same data as the first page table management object address, and replacing the page table entry of the original first page table management object address in the page table management object with the second page table management object address, so as to monitor a single process flexibly. In this way, the process can be monitored by replacing the page table entry of the process to be monitored. Compared with the method of using chip technology to monitor all processes in the prior art, the present invention does not require the support of chip technology and can also perform flexible monitoring of a single process.

[0027] Further, the content of the acquired first page table management object address is copied to a preset memory block to obtain the second page table management object address, including:

[0028] The acquired first page table management object address is data aligned, and the content of the first page table management object address is copied to a preset memory block according to the offset of the data alignment to obtain a second page table management object address.

[0029] As can be seen from the above description, aligning data on addresses and copying data according to the aligned offset can improve the efficiency and performance of data reading and writing.

[0030] Furthermore, the step of performing data alignment on the acquired first page table management object address includes:

[0031] A corresponding alignment start address is determined according to the first page table management object address, and an offset is obtained according to the first page table management object address and the alignment start address.

[0032] It can be seen from the above description that data alignment of the first page table management object address can quickly perform addressing operations and avoid wasting unnecessary time and resources.

[0033] Further, the step of copying the content of the first page table management object address to a preset memory block according to the data alignment offset to obtain the second page table management object address includes:

[0034] The content of the first page table management object address is copied to a preset memory block, and the offset is added to obtain a second page table management object address.

[0035] From the above description, it can be seen that since the first page table management object address belongs to a certain position in the starting alignment address, the offset of the original starting alignment address of the first page table management object address is obtained and the offset is copied based on this, so that the position of the second page table management object address at the preset memory address can be accurately located.

[0036] Further, monitoring the address on the preset memory block includes:

[0037] By acquiring the second page table management object address in the page table management object of the process to be monitored, the content of the second page table management object address is monitored.

[0038] From the above description, it can be seen that through this monitoring method, it is possible to flexibly monitor the processes that you want to monitor without destroying the original system call method, while reducing the workload brought by data cleaning.

[0039] Please refer to Figure 2 Another embodiment of the present invention provides a process monitoring terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0040] Obtaining a process page table address of a process to be monitored, determining a corresponding page table management object of a system space according to the process page table address, and obtaining a first page table management object address corresponding to the process to be monitored from the page table management object;

[0041] Copy the content of the first page table management object address obtained into a preset memory block to obtain a second page table management object address;

[0042] The page table entry corresponding to the first page table management object address in the page table management object is modified to the second page table management object address, and the second page table management object address is monitored.

[0043] From the above description, it can be seen that the beneficial effect of the present invention is: obtaining the process page table address of the process to be monitored, which stores a common page table management object, thereby obtaining the first page table management object address corresponding to the process to be monitored, and then creating a preset memory block with the same data as the first page table management object address, and replacing the page table entry of the original first page table management object address in the page table management object with the second page table management object address, so as to monitor a single process flexibly. In this way, the process can be monitored by replacing the page table entry of the process to be monitored. Compared with the method of using chip technology to monitor all processes in the prior art, the present invention does not require the support of chip technology and can also perform flexible monitoring of a single process.

[0044] Further, the content of the acquired first page table management object address is copied to a preset memory block to obtain the second page table management object address, including:

[0045] The acquired first page table management object address is data aligned, and the content of the first page table management object address is copied to a preset memory block according to the offset of the data alignment to obtain a second page table management object address.

[0046] As can be seen from the above description, aligning data on addresses and copying data according to the aligned offset can improve the efficiency and performance of data reading and writing.

[0047] Furthermore, the step of performing data alignment on the acquired first page table management object address includes:

[0048] A corresponding alignment start address is determined according to the first page table management object address, and an offset is obtained according to the first page table management object address and the alignment start address.

[0049] It can be seen from the above description that data alignment of the first page table management object address can quickly perform addressing operations and avoid wasting unnecessary time and resources.

[0050] Further, the step of copying the content of the first page table management object address to a preset memory block according to the data alignment offset to obtain the second page table management object address includes:

[0051] The content of the first page table management object address is copied to a preset memory block, and the offset is added to obtain a second page table management object address.

[0052] From the above description, it can be seen that since the first page table management object address belongs to a certain position in the starting alignment address, the offset of the original starting alignment address of the first page table management object address is obtained and the offset is copied based on this, so that the position of the second page table management object address at the preset memory address can be accurately located.

[0053] Further, monitoring the address on the preset memory block includes:

[0054] By acquiring the second page table management object address in the page table management object of the process to be monitored, the content of the second page table management object address is monitored.

[0055] From the above description, it can be seen that through this monitoring method, it is possible to flexibly monitor the processes that you want to monitor without destroying the original system call method, while reducing the workload brought by data cleaning.

[0056] The process monitoring method and terminal of the present invention are suitable for single or multiple process monitoring, can flexibly monitor any process, and do not require the support of chip technology. The following is an explanation through specific implementation methods:

[0057] Embodiment 1

[0058] Please refer to Figure 1 , a process monitoring method, comprising the steps of:

[0059] S1. Obtain a process page table address of a process to be monitored, determine a corresponding page table management object of a system space according to the process page table address, and obtain a first page table management object address corresponding to the process to be monitored from the page table management object.

[0060] Please refer to Figure 3 All process spaces are divided into system space and user space. All processes contained in the system space share a page table management object, namely the kernel page table, which contains the page table entries of the API pages to which they belong; while the user space page table exists independently to distinguish the independence of each process data, and it may reference API functions from the system space.

[0061] Therefore, each process has an independent process page table address, which stores the system space shared by the processes. The user space contains the system API page table entries that the user page table will reference, and the page table entries store the physical address corresponding to each memory address.

[0062] In this embodiment, the system consists of several processes, for example:

[0063] Process 1: System, process ID: 4;

[0064] Process 2: Smss, process ID: 505;

[0065] Process 3: Support, process ID: 700.

[0066] Processes 1 to 3 all have a common page table management object, and there is a PatchGuard that protects the address of the common page table management object.

[0067] For the convenience of developers, several API interfaces have been developed. When developers reference and use the API, they will be executed in the relevant system space. If the system space is modified directly, all process object calls will be taken over. PatchGuard will detect it and cause the system to crash. For example, 0xFFFFF8000988E is a public API address. If you modify this address directly, PatchGuard will detect it and terminate the system, causing the system to crash.

[0068] Therefore, in this embodiment, the page table address of the process to be monitored is obtained, and the corresponding first page table management object address in the system space to be monitored, that is, the system API address, is taken out. Since the system space belongs to shared memory, the address is unique.

[0069] S2. Copy the content of the first page table management object address obtained to a preset memory block to obtain a second page table management object address.

[0070] The acquired first page table management object address is data aligned, and the content of the first page table management object address is copied to a preset memory block according to the offset of the data alignment to obtain the second page table management object address.

[0071] S21. Determine a corresponding alignment start address according to the first page table management object address, and obtain an offset according to the first page table management object address and the alignment start address.

[0072] Specifically, in the storage, transmission and processing of computers, data is often processed in the form of blocks, and each block has a certain capacity. 4K alignment means that the starting address (starting byte) of these data blocks must be an integer multiple of 4K. 4K alignment is an optimization method used to improve the efficiency and performance of data reading and writing. Without 4K alignment, more addressing operations are required when reading and writing data, wasting unnecessary time and resources.

[0073] In this embodiment, the retrieved API address page is 4K aligned, and the 4K aligned PAGE_SIZE is set to 0X1000. For example, if the API address is 0x14585E, then its 4K starting address is 0x145000, and the offset is 0x85E.

[0074] S22: Copy the content of the first page table management object address to a preset memory block, and add the offset to obtain a second page table management object address.

[0075] Specifically, the content of the first page table management object address is copied to a preset memory block as data to replace the original page address.

[0076] In this embodiment, assume that the newly allocated memory address is: 0x2400. If the API address is copied directly, there is no alignment. You can only first obtain the starting alignment address corresponding to the API address to be copied: 0x145000, copy the 0x145000 data to 0x24000, and then add the offset 0x85E to get the new API function address.

[0077] Therefore, each API has its own start alignment address in the form of XXX000, and the allocated new memory address must also meet the above conditions. Since the API is located somewhere in the start alignment address, it is necessary to calculate the start alignment address through the API, obtain the offset of the original start alignment address of the API, and locate the position of the new API at the new memory address.

[0078] S3. Modify the page table entry corresponding to the first page table management object address in the page table management object to the second page table management object address, and monitor the second page table management object address.

[0079] Specifically, by acquiring the second page table management object address in the page table management object of the process to be monitored, the content of the second page table management object address is monitored.

[0080] In this embodiment, the page table entry is modified by setting a memory with the same data as the public API address 0x14585E to replace it. Since PatchGuard protects the public address 0x14585E, and the new memory address does not belong to the protection range, the monitoring of a single process can be completed.

[0081] For example: Support is a plug-in process, and the 0x14585EAPI function is the key function involved in reading, that is, the operation can be completed by simply replacing the page table entry of the Support process without affecting the use of all processes.

[0082] If VT technology is used, it is equivalent to taking over the entire system. All operations of the shared API page table are captured, so data filtering and data cleaning are also required.

[0083] In this embodiment, there is no need to use VT technology. If the scanned process file name is suspicious, or the process file does not have the digital signature of a legitimate manufacturer, the page table corresponding to the above-mentioned related API functions is modified and monitored. If the parameters in the monitoring involve offensive code related to the target process, that is, the "identity information" is suspicious to certain, the process information is obtained at the same time: process name, process path, file MD5 and other information.

[0084] This process repeats itself without destroying the original system call method, while allowing for flexible monitoring of suspicious processes that you want to monitor, while reducing the workload of data cleaning.

[0085] Embodiment 2

[0086] Please refer to Figure 2 A process monitoring terminal 1 includes a memory 2, a processor 3, and a computer program stored in the memory 2 and executable on the processor 3. When the processor 3 executes the computer program, each step of a process monitoring method of embodiment 1 is implemented.

[0087] In summary, the present invention provides a process monitoring method and terminal, which obtains the process page table address of the process to be monitored, and the address stores a common page table management object, thereby obtaining the first page table management object address corresponding to the process to be monitored, and then creates a preset memory block with the same data as the first page table management object address, and replaces the page table entry of the original first page table management object address in the page table management object with the second page table management object address, so as to flexibly monitor a single process. In this way, through simulated reconstruction and replacement, the single process page table management realizes the monitoring of the page table of a single process. The required monitoring object is converted into the physical address corresponding to the page table and monitored. As long as the page table entry of the process to be monitored is replaced, the process can be monitored. Compared with the method of using chip technology to monitor all processes in the prior art, the present invention does not require the support of PatchGuard or chip technology, and can perform flexible monitoring of a single process.

[0088] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A process monitoring method, characterized in that: Includes steps: Obtaining a process page table address of a process to be monitored, determining a corresponding page table management object of a system space according to the process page table address, and obtaining a first page table management object address corresponding to the process to be monitored from the page table management object; Copy the content of the first page table management object address obtained into a preset memory block to obtain a second page table management object address; The page table entry corresponding to the first page table management object address in the page table management object is modified to the second page table management object address, and the second page table management object address is monitored.

2. A process monitoring method according to claim 1, characterized in that: The content of the first page table management object address obtained is copied to the preset memory block to obtain the second page table management object address including: The acquired first page table management object address is data aligned, and the content of the first page table management object address is copied to a preset memory block according to the offset of the data alignment to obtain a second page table management object address.

3. A process monitoring method according to claim 2, characterized in that: The step of performing data alignment on the acquired first page table management object address comprises: A corresponding alignment start address is determined according to the first page table management object address, and an offset is obtained according to the first page table management object address and the alignment start address.

4. A process monitoring method according to claim 2, characterized in that: The step of copying the content of the first page table management object address to a preset memory block according to the data alignment offset to obtain the second page table management object address comprises: The content of the first page table management object address is copied to a preset memory block, and the offset is added to obtain a second page table management object address.

5. A process monitoring method according to claim 1, characterized in that: Monitoring the address on the preset memory block includes: By acquiring the second page table management object address in the page table management object of the process to be monitored, the content of the second page table management object address is monitored.

6. A process monitoring terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the following steps are implemented: Obtaining a process page table address of a process to be monitored, determining a corresponding page table management object of a system space according to the process page table address, and obtaining a first page table management object address corresponding to the process to be monitored from the page table management object; Copy the content of the first page table management object address obtained into a preset memory block to obtain a second page table management object address; The page table entry corresponding to the first page table management object address in the page table management object is modified to the second page table management object address, and the second page table management object address is monitored.

7. A process monitoring terminal according to claim 6, characterized in that: The content of the first page table management object address obtained is copied to the preset memory block to obtain the second page table management object address including: The acquired first page table management object address is data aligned, and the content of the first page table management object address is copied to a preset memory block according to the offset of the data alignment to obtain a second page table management object address.

8. A process monitoring terminal according to claim 7, characterized in that: The step of performing data alignment on the acquired first page table management object address comprises: A corresponding alignment start address is determined according to the first page table management object address, and an offset is obtained according to the first page table management object address and the alignment start address.

9. A process monitoring terminal according to claim 7, characterized in that: The step of copying the content of the first page table management object address to a preset memory block according to the data alignment offset to obtain the second page table management object address comprises: The content of the first page table management object address is copied to a preset memory block, and the offset is added to obtain a second page table management object address.

10. A process monitoring terminal according to claim 6, characterized in that: Monitoring the address on the preset memory block includes: By acquiring the second page table management object address in the page table management object of the process to be monitored, the content of the second page table management object address is monitored.

Images